CrackerTracker Exploit False Positives

[geoff1]

One for altering the group de.scriptions:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/admin/admin_groups.php
----------------

Request-Method: POST

Matching rule: or
In variable: group_de.scription

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/admin/admin_groups.php

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);

#
#-----[ AFTER, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('group_de.scription');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

[Helter]

this is what I have for admin_pa_catagory

Code: Select all

define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('addcategory','submit');

and for admin_groups

Code: Select all

define('CT_SECLEVEL', 'LOW');$ct_ignorepvar = array('new','group_name','group_de.scription','username');

[zenrei]

Thanks guys for the contributions, they really are helping out.

For PCP Wizard, try opening up admin/admin_pcp_wizard.php and replacing the MEDIUM with LOW. That may solve all issues with the wizard.

what medium??

I just went into the php in edit mode and there isn't anything that says MEDIUM

[CaNNon]

That was done in 2 parts, they added the medium then dropped it to low.
combined it should be like this.

Find ---> define('IN_PHPBB', 1);
Then add ---> define('CT_SECLEVEL', 'LOW');

[zenrei]

yeah... thanks <img> i didn't figure that out until later... i was having one of my dork moments

[Juppertje]

every whee is see here

#
#-----[ FIND ]------------------------------------------
#
define('IN_PHPBB', 1);



But i only have


define('IN_PHPBB', true);

so is this the same or have i also to replace define('IN_PHPBB', true); with define('IN_PHPBB', 1); ?

[CaNNon]

1 and true are the same, just add the line after it.

[Juppertje]

1 and true are the same, just add the line after it.

okay txs

[nGAGE]

Just wondering... with all these fixes being posted... WHY do these problems happen in the first place? Shouldn't there be a patch to fix what's necessary if it's such a common problem? or are these problems not applicable on every install?
I (to be honest) find it an extreme pain in my behind and it takes me more time to fix this crap-tracker then to design an entire theme. Please find a solution for this! If necessary, post a tutorial on uninstalling crap-tracker from IM... as I've only had useless problems with it constantly banning my members for no reason or blocking me from doing the most common/basic admin tasks! This only prevents me from managing my site properly and I've got other things to do as well then to check .scripts everytime a function fails to co-operate.

Don't get me wrong! I love IM and I intend on using it, but the crap-tracker is more of a pain in the behind then it does good to me.

[ZacFields]

ngage,

Not sure if you've tried my patch yet. There is a patch out there but it is very much a work-in-progress. I haven't updated it in a while but it solves the most basic problems with crackertracker. Mainly the admin-side stuff.

http://www.integramod.com/forum/viewtopic.php?t=2830

Zac

[nGAGE]

Thnx... Truly appreciate that link. Missed that post! I'll surely post if I encounter anymore problems <img>

[nGAGE]

ADDING ALLOWED HTML-Code

OPEN admin/admin_board.php

FIND

Code: Select all

 define('IN_PHPBB', 1);  

AFTER ADD

Code: Select all

 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('allow_html_tags',);  

IF $ct_ignorepvar EXISTS]  $ct_ignorepvar = array('***');  [/php]

*** = Being any code existing already

INLINE, FIND

Code: Select all

 );  

INLINE, REPLACE

Code: Select all

 ,'allow_html_tags');  

[.QUACK.Major.Pain]

I checked that file and already in my file from my original install.
Think someone beat you to it .

I'm still waiting for a fix to use html in posts. Trying to use paypal Buy Now button but only offered in html.

[nGAGE]

Maybe I've overlooked it with the previous fixes posted here, but I've just been trying to make a collection of all of them on my own site as well, as I still have a theory about the patch mentioned somewhere that overwrites only the ctracker/engines/ct_security.php file to fix a lot of the CT issues.

It seems to me that it just adds all this stuff to be "Ignored" and I'm not sure that could have a "Global" effect and effect on the security itself! Fixing the individual files that actually cause problems seems a better bet to me, but ok... I'm not knowledgeable enough with php to make a proper statement!

Will try to find out more about that theory though and keep you all posted.

[nGAGE]

Could be that I've overlooked this one somewhere, but still... here we go:

Creating KnowledgeBase Types

OPEN /admin/admin_kb_types.php

FIND

Code: Select all

 if ( file_exists( './../viewtopic.php' ) ){     define( 'IN_PHPBB', 1 );     define( 'IN_PORTAL', 1 );     define( 'MXBB_MODULE', false );  

AFTER ADD

Code: Select all

 define('CT_SECLEVEL', 'MEDIUM');$ct_ignorepvar = array('create','edit','delete');  

IF $ct_ignorepvar EXISTS
FIND / INLINE, FIND

Code: Select all

 $ct_ignorepvar = array(  

INLINE, AFTER ADD

Code: Select all

 'create','edit','delete',  

PS]http://www.net-clan-gaming.com/viewforum.php?f=54[/url]